Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8f0b1d5c authored by Rob Clark's avatar Rob Clark Committed by Greg Kroah-Hartman
Browse files

drm/vmwgfx: fix memory corruption with legacy/sou connectors 



commit 8a510a5c75261ba0ec39155326982aa786541e29 upstream.

It looks like in all cases 'struct vmw_connector_state' is used.  But
only in stdu connectors, was atomic_{duplicate,destroy}_state() properly
subclassed.  Leading to writes beyond the end of the allocated connector
state block and all sorts of fun memory corruption related crashes.

Fixes: d7721ca7 "drm/vmwgfx: Connector atomic state"
Signed-off-by: default avatarRob Clark <rclark@redhat.com>
Reviewed-by: default avatarThomas Hellstrom <thellstrom@vmware.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent a6d5930c

drivers/gpu/drm/vmwgfx/vmwgfx_ldu.c

+2 −2
Original line number Diff line number Diff line
@@ -266,8 +266,8 @@ static const struct drm_connector_funcs vmw_legacy_connector_funcs = { 
	.set_property = vmw_du_connector_set_property,

	.destroy = vmw_ldu_connector_destroy,

	.reset = vmw_du_connector_reset,

	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,

	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,

	.atomic_duplicate_state = vmw_du_connector_duplicate_state,

	.atomic_destroy_state = vmw_du_connector_destroy_state,

	.atomic_set_property = vmw_du_connector_atomic_set_property,

	.atomic_get_property = vmw_du_connector_atomic_get_property,

};

drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c

+2 −2
Original line number Diff line number Diff line
@@ -420,8 +420,8 @@ static const struct drm_connector_funcs vmw_sou_connector_funcs = { 
	.set_property = vmw_du_connector_set_property,

	.destroy = vmw_sou_connector_destroy,

	.reset = vmw_du_connector_reset,

	.atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state,

	.atomic_destroy_state = drm_atomic_helper_connector_destroy_state,

	.atomic_duplicate_state = vmw_du_connector_duplicate_state,

	.atomic_destroy_state = vmw_du_connector_destroy_state,

	.atomic_set_property = vmw_du_connector_atomic_set_property,

	.atomic_get_property = vmw_du_connector_atomic_get_property,

};